CAPTURE THE NARRATIVE PRIVACY POLICY

Effective date: 31 August 2026

Capture the Narrative and the CTN Community are operated by Digital Lies and Cyber Literacy Foundation Limited (ABN 32 700 329 586), trading as the Digital Lies & Cyber Literacy Foundation (“DLCL”, “we”, “us” or “our”).

This policy explains how we handle personal information through Capture the Narrative websites, community and competition platforms, APIs, communications and connected services. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply, and use those principles as our privacy standard in all cases.

1. Information we collect

We may collect:

Account and eligibility information: your name, academic email address, university or institution, student or university ID, country of residence, authentication details stored in protected form, referral code, and records of your agreements or consents.
Community and competition information: enrolments, teams, roles, referrals, linked-service identifiers (such as Discord), messages and support requests, submissions, competition-platform and API activity, scores, rankings, awards, moderation and rule-enforcement records, and prize or publicity information.
Technical information: IP address, device and browser information, cookies and session identifiers, timestamps, and login, audit and security logs.
Opt-in public information: public social-media handles, posts and engagement metrics where you enter a referral, publicity or real-world engagement activity.

We collect information directly from you, automatically when you use our services, and where reasonably necessary from team members, referrers, connected services, participating institutions, program partners and public sources. If required information is not provided, we may be unable to create your account, verify eligibility, provide a feature or award a prize.

Please do not provide unnecessary sensitive or private information. Any sensitive information intentionally collected for research is covered by separate research materials and consent.

2. How we use information

We may collect, hold, use and otherwise process information to:

create and manage accounts, verify eligibility, organise teams, administer referrals and connect optional services;
operate, communicate about, secure, moderate, score, judge and improve the community and competitions;
prevent fraud, abuse and security incidents, investigate complaints, enforce rules and protect participants and our systems;
calculate participation, engagement, referral, scoring and impact measures;
analyse and evaluate our programs, improve our technology, plan future activities, seek or acquit funding, and report outcomes to supporters and partners;
publish competition results and recognise participants as described in the competition rules or an applicable publicity consent;
maintain participation, award and conduct records, and tell you about relevant future Capture the Narrative or DLCL activities; and
meet legal obligations and establish, exercise or defend legal claims.

For these purposes, we may validate, link, organise, correct, update, transform, derive, analyse, aggregate, de-identify, archive and delete data. This includes deriving records such as eligibility status, team membership, referral credits, scores, rankings, security indicators and engagement metrics. We use de-identified or aggregated information where reasonably practicable.

Operational messages are part of providing the service. You may opt out of optional promotional messages at any time without closing your account.

3. Research is separate

Use of participant or competition data in a human research project is separate from ordinary competition administration and program evaluation. Before such use, participants will receive separate participant information and consent materials, together with ethics approval information where required.

Declining or withdrawing from research will not, by itself, close your CTN account or disqualify you from a competition unless the separate research materials clearly state otherwise. Research records are handled under the applicable consent, ethics approval and institutional requirements.

We may disclose the information reasonably needed by:

service providers that provide hosting, email, authentication, security, analytics, surveys, communications, collaboration, payment or technical support;
competition and program partners, including administrators, judges, participating institutions, sponsors and funding bodies, where needed to verify eligibility, run or support a program, deliver prizes, investigate misconduct, evaluate impact or meet reporting obligations;
connected services that you use as part of the community, such as a linked Discord account or a survey platform;
professional advisers, insurers, regulators, courts, law-enforcement bodies or other authorities where reasonably necessary or required or authorised by law; and
the public, for leaderboards, results and recognition. Public information may include a display or team name, institution, score, ranking and finalist or winner status. We will not publish your academic email address or student ID. Photos, biographies or similar publicity material will be used only where covered by the rules or an appropriate consent.

Identifiable information is shared with partners only where reasonably necessary for the stated purpose and subject to appropriate use or confidentiality limits. Funding and impact reporting will normally use aggregated or de-identified information.

We do not sell or rent personal information, and we do not allow partners to use it for unrelated marketing without separate consent.

5. Overseas processing and third-party services

Some providers and connected services may store or process information outside Australia. As at the effective date, likely locations include Australia and the United States; globally distributed providers may also process information in other countries. We take reasonable steps to select reputable providers and require appropriate privacy and security protections.

Third-party services have their own privacy terms. You should review them before connecting or using those services.

6. Automated systems

Some checks or calculations may be made solely or substantially by computer programs. We may use account, eligibility, participation and technical information to validate academic email domains or eligibility, detect abuse, credit referrals, calculate scores or rankings, and support moderation or rule enforcement. These processes may affect registration, access, referral credit, rankings, moderation or eligibility. You may contact us to request review of a decision.

7. Retention and account deletion

We retain identifiable account and competition records while your account is active and for as long as reasonably needed for administration, future participation, awards, auditing, security, rule enforcement, dispute resolution, program reporting and legal obligations. We delete or de-identify personal information when it is no longer needed for a permitted purpose. De-identified or aggregated information and public competition results may be retained indefinitely.

You may delete your account at any time through the account controls, where available, or by contacting us. We will delete or de-identify personal information that is no longer required, but may retain a limited record where reasonably necessary for legal or financial records, security, fraud prevention, enforcement of exclusions, disputes, backups, or separately governed research. Team submissions and public results may remain where needed to preserve an accurate competition record, but we will de-identify them where reasonably practicable.

Deleted information may remain in protected backups until those backups are overwritten through our normal retention cycle. It will not be used for ordinary operations while awaiting deletion.

8. Security and data breaches

We use reasonable technical and organisational safeguards to protect personal information from loss, misuse, interference and unauthorised access, modification or disclosure. No system can be guaranteed completely secure. Where required by law, we will notify affected individuals and the Office of the Australian Information Commissioner of an eligible data breach.

9. Access, correction, deletion and complaints

You may ask us to:

provide access to personal information we hold about you;
correct information that is inaccurate, out of date, incomplete, irrelevant or misleading;
delete your account or personal information, subject to the limits described above;
withdraw a consent or change communication preferences; or
investigate a privacy complaint.

Contact the Privacy Officer at privacy@capturethenarrative.com. We may need to verify your identity. We will acknowledge a complaint and aim to respond within 30 days. If you are not satisfied, you may contact the Office of the Australian Information Commissioner, subject to its jurisdiction.

10. Changes to this policy

We may update this policy to reflect changes to our services, practices or legal obligations. We will publish the updated policy with a new effective date and notify registered users of material changes by email or through the portal before or when they take effect.

We will seek separate consent where a new use legally requires it. If you do not accept a material change, you may stop using the services and delete your account or ask us to delete your personal information, subject to the retention limits above.